1 1 00:00:00,570 --> 00:00:02,430 Golden ticket. 2 2 00:00:02,430 --> 00:00:03,780 Now, in the last lesson 3 3 00:00:03,780 --> 00:00:06,480 we talked about the pass the hash attack. 4 4 00:00:06,480 --> 00:00:10,350 Now a pass the hash attack will work on local workstations 5 5 00:00:10,350 --> 00:00:12,270 but if you're going to be using something 6 6 00:00:12,270 --> 00:00:13,560 on a domain environment 7 7 00:00:13,560 --> 00:00:15,960 you're really going to need to attack a Kerberos ticket 8 8 00:00:15,960 --> 00:00:17,040 because this is what's used 9 9 00:00:17,040 --> 00:00:18,990 in an active directory environment. 10 10 00:00:18,990 --> 00:00:21,810 The pass the hash attack can work on multiple workstations 11 11 00:00:21,810 --> 00:00:24,780 across the domain if those systems 12 12 00:00:24,780 --> 00:00:27,390 have all been logged into by the same user. 13 13 00:00:27,390 --> 00:00:28,620 But if they haven't 14 14 00:00:28,620 --> 00:00:31,710 then you're going to need to work on a golden ticket instead. 15 15 00:00:31,710 --> 00:00:33,990 Now, what is a golden ticket? 16 16 00:00:33,990 --> 00:00:35,407 Well, if you've ever read the book 17 17 00:00:35,407 --> 00:00:37,950 "Charlie and the Chocolate Factory" or seen the movie 18 18 00:00:37,950 --> 00:00:39,870 you've probably heard of a golden ticket. 19 19 00:00:39,870 --> 00:00:41,910 Essentially, this was the winning ticket 20 20 00:00:41,910 --> 00:00:43,620 that got you unlocked privileges 21 21 00:00:43,620 --> 00:00:46,320 to anything you wanted inside their factory. 22 22 00:00:46,320 --> 00:00:49,080 It was a universal skeleton key essentially, 23 23 00:00:49,080 --> 00:00:50,580 and essentially in our networks 24 24 00:00:50,580 --> 00:00:52,590 that's what a golden ticket is. 25 25 00:00:52,590 --> 00:00:54,390 When I talk about a golden ticket, 26 26 00:00:54,390 --> 00:00:56,220 a golden ticket is a Kerberos ticket 27 27 00:00:56,220 --> 00:00:57,630 that can grant other tickets 28 28 00:00:57,630 --> 00:00:59,520 in an active directory environment. 29 29 00:00:59,520 --> 00:01:02,250 And so it can create keys that allow you to get access 30 30 00:01:02,250 --> 00:01:03,690 to anything you want. 31 31 00:01:03,690 --> 00:01:06,000 Golden tickets can grant administrative access 32 32 00:01:06,000 --> 00:01:08,670 to other domain members and domain controllers 33 33 00:01:08,670 --> 00:01:12,090 within the network, and so they are really, really powerful. 34 34 00:01:12,090 --> 00:01:13,560 Before we talk about exactly 35 35 00:01:13,560 --> 00:01:15,540 how a golden ticket attack works 36 36 00:01:15,540 --> 00:01:18,180 I think it's important for us to revisit a key concept 37 37 00:01:18,180 --> 00:01:20,130 about how Kerberos works. 38 38 00:01:20,130 --> 00:01:21,960 Now, this is going to be a very quick review 39 39 00:01:21,960 --> 00:01:23,970 because this is something you should have already learned 40 40 00:01:23,970 --> 00:01:25,560 back in Security Plus 41 41 00:01:25,560 --> 00:01:27,810 but I want to provide a quick refresher 42 42 00:01:27,810 --> 00:01:30,570 so you can better understand how this attack works. 43 43 00:01:30,570 --> 00:01:35,100 First, we have something known as a krbtgt hash, 44 44 00:01:35,100 --> 00:01:37,410 which is essentially a Kerberos ticket-granting 45 45 00:01:37,410 --> 00:01:39,540 ticket hash is what it stands for. 46 46 00:01:39,540 --> 00:01:42,780 Now this is the trust anchor of active directory domains 47 47 00:01:42,780 --> 00:01:44,520 and these function like a private key 48 48 00:01:44,520 --> 00:01:46,200 of a root certificate authority, 49 49 00:01:46,200 --> 00:01:48,540 and they're used to generate ticket-granting tickets 50 50 00:01:48,540 --> 00:01:51,090 that are used by users across the network 51 51 00:01:51,090 --> 00:01:54,090 to access services within Kerberos. 52 52 00:01:54,090 --> 00:01:57,420 Now, under Kerberos, a client is generally going to be a user 53 53 00:01:57,420 --> 00:01:59,610 or a service, and they're going to send a request 54 54 00:01:59,610 --> 00:02:03,750 for a ticket to the KDC, the key distribution center. 55 55 00:02:03,750 --> 00:02:06,690 The KDC will then create this ticket-granting ticket 56 56 00:02:06,690 --> 00:02:09,000 or TGT for the client. 57 57 00:02:09,000 --> 00:02:10,920 It's going to encrypt it using the client's password 58 58 00:02:10,920 --> 00:02:13,110 as the key and then send the encrypted ticket 59 59 00:02:13,110 --> 00:02:14,460 back to the client. 60 60 00:02:14,460 --> 00:02:17,040 The client will then attempt to decrypt the TGT 61 61 00:02:17,040 --> 00:02:20,640 or the ticket-granting ticket using the client's password. 62 62 00:02:20,640 --> 00:02:22,560 If the client successfully is able to decrypt 63 63 00:02:22,560 --> 00:02:23,850 the ticket-granting ticket 64 64 00:02:23,850 --> 00:02:25,980 this means the client gave the right password 65 65 00:02:25,980 --> 00:02:28,470 and the ticket-granting ticket will be decrypted 66 66 00:02:28,470 --> 00:02:31,410 which indicates proof of the client's identity. 67 67 00:02:31,410 --> 00:02:33,750 Now, the ticket-granting ticket will expire 68 68 00:02:33,750 --> 00:02:36,570 after a certain time, and this will allow the user 69 69 00:02:36,570 --> 00:02:38,220 to be able to obtain additional tickets 70 70 00:02:38,220 --> 00:02:39,150 whenever they need them 71 71 00:02:39,150 --> 00:02:41,730 and get permission for specific services. 72 72 00:02:41,730 --> 00:02:44,040 The requesting and granting of these additional tickets 73 73 00:02:44,040 --> 00:02:45,780 is considered user transparent 74 74 00:02:45,780 --> 00:02:47,520 and happens all the way in the background 75 75 00:02:47,520 --> 00:02:49,410 in these Windows environments. 76 76 00:02:49,410 --> 00:02:52,710 Now, as I said, the Kerberos ticket grading ticket hash 77 77 00:02:52,710 --> 00:02:55,800 is the trust anchor to this whole thing on the server 78 78 00:02:55,800 --> 00:02:58,230 as it is generating the ticket-granting tickets. 79 79 00:02:58,230 --> 00:03:00,540 So if an attacker could compromise that 80 80 00:03:00,540 --> 00:03:03,262 this whole system could be used to create their own tickets 81 81 00:03:03,262 --> 00:03:06,090 and gain authorization to anything they want. 82 82 00:03:06,090 --> 00:03:09,390 And that's exactly how a golden ticket attack works. 83 83 00:03:09,390 --> 00:03:13,050 They go after this Kerberos ticket-granting ticket hash. 84 84 00:03:13,050 --> 00:03:14,850 So let's see how that works. 85 85 00:03:14,850 --> 00:03:18,149 First, how does a golden ticket attack work? 86 86 00:03:18,149 --> 00:03:19,890 The first thing is the attacker 87 87 00:03:19,890 --> 00:03:24,450 is going to try to access the NTDS.DIT file. 88 88 00:03:24,450 --> 00:03:27,270 This allows the attacker to gain access to this file 89 89 00:03:27,270 --> 00:03:29,670 that contains the active directories data store 90 90 00:03:29,670 --> 00:03:31,110 and inside of that is 91 91 00:03:31,110 --> 00:03:33,360 the Kerberos ticket-granting ticket hash 92 92 00:03:33,360 --> 00:03:36,240 and all of the hashes for the administrative accounts. 93 93 00:03:36,240 --> 00:03:39,510 Now that the attacker has this NTDS.DITs file 94 94 00:03:39,510 --> 00:03:40,350 they can dump it 95 95 00:03:40,350 --> 00:03:43,350 and identify the Kerberos ticket-granting ticket hash, 96 96 00:03:43,350 --> 00:03:45,510 and those administrative hashes. 97 97 00:03:45,510 --> 00:03:48,630 Once they've done that, they can move on to the fun part. 98 98 00:03:48,630 --> 00:03:51,540 And as an attacker, this is going to be really good for them 99 99 00:03:51,540 --> 00:03:53,610 but really bad for our defenders. 100 100 00:03:53,610 --> 00:03:56,610 As defenders, we may identify that a breach has occurred 101 101 00:03:56,610 --> 00:03:58,350 and we go forward and make everybody 102 102 00:03:58,350 --> 00:04:01,350 with an actor directory account reset their passwords. 103 103 00:04:01,350 --> 00:04:02,610 But if we don't reset 104 104 00:04:02,610 --> 00:04:04,740 the Kerberos ticket-granting ticket hash 105 105 00:04:04,740 --> 00:04:07,680 then the attacker will still have access 106 106 00:04:07,680 --> 00:04:10,230 and often responders will forget to do this. 107 107 00:04:10,230 --> 00:04:12,810 And this allows attackers to stay in these systems 108 108 00:04:12,810 --> 00:04:15,270 for a really long period of time. 109 109 00:04:15,270 --> 00:04:17,760 So our attacker who still has a valid 110 110 00:04:17,760 --> 00:04:19,710 Kerberos ticket-granting ticket hash 111 111 00:04:19,710 --> 00:04:22,500 can use an exploit module to create golden tickets 112 112 00:04:22,500 --> 00:04:24,960 for a user in the administrative group. 113 113 00:04:24,960 --> 00:04:26,760 Now that they have that golden ticket created 114 114 00:04:26,760 --> 00:04:29,160 with the Kerberos ticket-granting ticket hash 115 115 00:04:29,160 --> 00:04:30,810 they are now ready to do whatever else 116 116 00:04:30,810 --> 00:04:32,670 they want to do on that system 117 117 00:04:32,670 --> 00:04:35,670 because the attacker can use that golden ticket 118 118 00:04:35,670 --> 00:04:38,430 to assume an administrative identity. 119 119 00:04:38,430 --> 00:04:41,370 So they can now do follow on exploitation 120 120 00:04:41,370 --> 00:04:43,488 and do whatever they need to do on that system 121 121 00:04:43,488 --> 00:04:45,630 or even across the domain 122 122 00:04:45,630 --> 00:04:47,220 because those tickets work 123 123 00:04:47,220 --> 00:04:50,340 with Kerberos which works across the domain. 124 124 00:04:50,340 --> 00:04:52,200 Now, for example, they might go ahead 125 125 00:04:52,200 --> 00:04:54,030 and compromise your domain controller. 126 126 00:04:54,030 --> 00:04:55,980 They could log in using that golden ticket 127 127 00:04:55,980 --> 00:04:58,500 and perform PowerShell or command line actions 128 128 00:04:58,500 --> 00:05:01,380 on that server or whatever bad action they want 129 129 00:05:01,380 --> 00:05:03,750 using that administrative level control. 130 130 00:05:03,750 --> 00:05:07,680 And this is why golden tickets are just so dangerous. 131 131 00:05:07,680 --> 00:05:09,720 So when you think about Golden Tickets, 132 132 00:05:09,720 --> 00:05:11,730 I want you to remember that golden tickets 133 133 00:05:11,730 --> 00:05:14,340 allow attackers to laterally move across 134 134 00:05:14,340 --> 00:05:16,590 the entire domain with ease. 135 135 00:05:16,590 --> 00:05:19,530 It is basically a skeleton key that can open any door 136 136 00:05:19,530 --> 00:05:21,600 they want on your network. 137 137 00:05:21,600 --> 00:05:25,410 So it's really important that administrators make sure 138 138 00:05:25,410 --> 00:05:28,410 that they reset the Kerberos ticket-granting ticket hash 139 139 00:05:28,410 --> 00:05:30,600 account password regularly. 140 140 00:05:30,600 --> 00:05:33,600 This will make sure that if you have been compromised 141 141 00:05:33,600 --> 00:05:35,670 you can clear out the ability of an attacker 142 142 00:05:35,670 --> 00:05:38,070 to create new golden tickets. 143 143 00:05:38,070 --> 00:05:40,020 Also, if you need to change 144 144 00:05:40,020 --> 00:05:42,810 the Kerberos ticket-granting ticket account password, 145 145 00:05:42,810 --> 00:05:44,970 you need to reset that password twice 146 146 00:05:44,970 --> 00:05:48,240 in a short period of time to invalidate the golden ticket 147 147 00:05:48,240 --> 00:05:49,920 if a breach is suspected. 148 148 00:05:49,920 --> 00:05:52,440 Essentially you're going to change the password, 149 149 00:05:52,440 --> 00:05:55,140 reboot the computer, change the password again, 150 150 00:05:55,140 --> 00:05:56,520 reboot the computer. 151 151 00:05:56,520 --> 00:05:59,100 By doing that, you are revoking all of the existing 152 152 00:05:59,100 --> 00:06:02,280 golden tickets and making sure the new ones are being issued 153 153 00:06:02,280 --> 00:06:05,520 with the new password, and that removes any ability 154 154 00:06:05,520 --> 00:06:09,150 of the attacker to use it inside your system anymore. 155 155 00:06:09,150 --> 00:06:10,920 Now, as we finish up this lesson 156 156 00:06:10,920 --> 00:06:13,380 I want to leave you with one quick warning. 157 157 00:06:13,380 --> 00:06:15,660 As you're reading up on a Golden Ticket attack 158 158 00:06:15,660 --> 00:06:17,190 as an analyst in the field, 159 159 00:06:17,190 --> 00:06:19,020 you may come across some older articles 160 160 00:06:19,020 --> 00:06:20,730 that talk about this technique. 161 161 00:06:20,730 --> 00:06:22,410 In those articles, they may mention 162 162 00:06:22,410 --> 00:06:23,243 that you should be looking 163 163 00:06:23,243 --> 00:06:25,830 for a domain name field being left blank 164 164 00:06:25,830 --> 00:06:27,720 as an indicator of compromise. 165 165 00:06:27,720 --> 00:06:30,159 And that is true for older golden ticket programs 166 166 00:06:30,159 --> 00:06:32,700 because they didn't include a domain name field 167 167 00:06:32,700 --> 00:06:34,470 when they made those golden tickets. 168 168 00:06:34,470 --> 00:06:35,970 And that way it made it very easy 169 169 00:06:35,970 --> 00:06:37,740 for us to detect them in the logs. 170 170 00:06:37,740 --> 00:06:41,280 But most of the newer golden ticket programs have fixed this 171 171 00:06:41,280 --> 00:06:43,290 and they actually include a domain name now. 172 172 00:06:43,290 --> 00:06:46,020 So this isn't the easy IOC that it used to be 173 173 00:06:46,020 --> 00:06:48,150 but it is still one that you should look for. 174 174 00:06:48,150 --> 00:06:50,430 Remember, all your log on and log off events 175 175 00:06:50,430 --> 00:06:52,560 are recorded in your Windows event log. 176 176 00:06:52,560 --> 00:06:53,910 And so you can actually look at them 177 177 00:06:53,910 --> 00:06:55,680 with the username and the domain name 178 178 00:06:55,680 --> 00:06:57,600 of the account that's logging in and out. 179 179 00:06:57,600 --> 00:06:59,520 And if you see one that doesn't have a domain name 180 180 00:06:59,520 --> 00:07:00,445 that could be an indication 181 181 00:07:00,445 --> 00:07:03,030 that somebody's using an older golden ticket program 182 182 00:07:03,030 --> 00:07:05,730 and they are using a golden ticket attack against you.